ZcashFoundation zebra

• CVE-2026-109366 Low 3.7 Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height 0.2%
• CVE-2026-109365 Low 3.7 Zebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies 0.1%
• CVE-2026-109364 Medium 5.3 Zebra 2.3.0 before 6.4.0 Peer Ban Bypass via Exact-IP Keying 0.2%
• CVE-2026-109363 High 7.5 Zebra 6.4.0 before 6.4.2 Denial of Service via Malformed v6 Transaction 0.4%
• CVE-2026-104437 High 7.4 Zebra before 4.4.0 Consensus Split via SIGHASH_SINGLE Missing-Output Handling 0.2%
• CVE-2026-104436 Low 3.7 Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length 0.3%
• CVE-2026-104435 High 7.4 Zebra 4.4.0 Consensus Divergence via V5 SIGHASH_SINGLE Without Output 0.2%
• CVE-2026-104434 Medium 6.5 Zebra before 8.0.0 Denial of Service via z_listunifiedreceivers RPC 0.3%
• CVE-2026-104432 Medium 5.3 Zebra before 6.3.0 False Readiness via Discarded One-Hash FindBlocks Response 0.3%
• CVE-2026-104431 High 7.5 Zebra before 6.0.0 Denial of Service via Synchronous Script FFI Verification 0.3%
• CVE-2026-104430 High 7.5 Zebra 4.5.0 Consensus Split via P2SH Sigop Overcount 0.4%
• CVE-2026-104429 Medium 5.3 Zebra before 6.0.0-rc.0 Per-Peer Mempool Admission Bypass via P2P tx Messages 0.3%
• CVE-2026-104428 Medium 5.3 Zebra before 11.0.0 Denial of Service via getblock Verbosity 2 0.4%
• CVE-2026-104427 Medium 5.9 Zebra before 6.1.0 Chain Stall via Stale parent_error_map Entry 0.3%
• CVE-2026-104426 Medium 5.9 Zebra before 6.1.0 Quadratic Complexity DoS via Block Transparent Value Check 0.3%
• CVE-2026-104425 Medium 5.3 Zebra before 6.1.0 Batch-Verification Poisoning DoS via Unattributed Pushed Transactions 0.3%
• CVE-2026-104424 Low 3.7 Zebra before 6.1.0 Incorrect Block Size Calculation in getblocktemplate 0.3%
• CVE-2026-104423 High 7.5 Zebra before 6.2.1 Denial of Service via Uncapped V6 Shielded Proof Verification 0.3%
• CVE-2026-104422 High 7.5 Zebra before 6.3.0 Block Sync Denial of Service via Coinbase scriptSig Rewrite 0.2%
• CVE-2026-104421 Medium 5.3 Zebra before 6.2.1 Block Download Denial of Service via KnownBlock SentHashes Lockout 0.3%
• CVE-2026-104420 Medium 5.3 Zebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped Blocks 0.3%
• CVE-2026-104419 Medium 4.8 Zebra before 6.3.0 Honest Peer Banning via Far-Ahead FindBlocks Hashes 0.1%
• CVE-2026-52829 High 7.5 ZEBRA: IPv4-Mapped Mempool Misbehavior Update Aborts Zebra Address Book 0.6%
• CVE-2026-52736 High 8.7 ZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cache 0.6%
• CVE-2026-52732 Medium 5.3 ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturation 0.5%
• CVE-2026-52731 Medium 6.5 ZEBRA: Full node denial of service via non-ASCII LongPollId in getblocktemplate 0.5%
• CVE-2026-52733 Medium 6.5 ZEBRA: Persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip 0.4%
• CVE-2026-52738 Medium 6.9 ZEBRA: Finalized address balance credit-first overflow on consensus-valid blocks 0.5%
• CVE-2026-52735 Critical 9.3 ZEBRA: Consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser 0.5%
• CVE-2026-52739 Medium 5.9 ZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection 0.5%
• CVE-2026-52734 Medium 5.3 ZEBRA: Unbounded memory leak in mempool download pipeline via timeout path cancel_handles retention 0.5%
• CVE-2026-52737 Medium 5.3 ZEBRA: Sync restart poisoning from single unauthenticated peer via above-lookahead block 0.3%
• CVE-2026-54496 Critical 9.3 Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness 0.3%
• CVE-2026-44499 High 8.7 ZEBRA: Permanent Block Discovery Halt via Gossip Queue Saturation and Syncer Poisoning 0.4%
• CVE-2026-44500 Medium 5.3 ZEBRA: Allocation Amplification in Inbound Network Deserializers 0.4%
• CVE-2026-44498 Critical 9.2 ZEBRA: Block Validator Undercounts Coinbase and P2SH Sigops 0.3%
• CVE-2026-44497 Critical 9.3 ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling due to Stale Buffer 0.2%
• CVE-2026-41585 Medium 6.9 ZEBRA: Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients 0.3%
• CVE-2026-41584 Critical 9.2 ZEBRA: rk Identity Point Panic in Transaction Verification 0.3%
• CVE-2026-41583 Critical 9.3 ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type Handling 0.3%
• CVE-2026-34377 High 8.4 Zebra has a Consensus Failure due to Improper Verification of V5 Transactions 0.3%
• CVE-2026-34202 Critical 9.2 Zebra node crash — V5 transaction hash panic (P2P reachable) 0.8%